Privacy Policy
Product: a web application for parents and children (ages 5–10) to read a short daily growth story, talk about it, and complete one real-world action.
Support email: nexoralabs392@gmail.com
1. Summary
We collect the minimum information needed to run accounts, keep your progress, and manage paid memberships. We do not sell personal data. This website runs no advertising and no third-party tracking.
2. Information we collect
- Account information: your email address and a password. Passwords are stored only as salted hashes by our authentication provider; we never see your plain password.
- Profile information you enter: optional child nickname, child age or age range, and the growth topics you choose.
- Progress data: which stories were opened, which actions were completed, growth energy, current day in the program, and last updated time.
- Membership data: plan name, subscription status, and current period end date, generated from payment events sent to us by our payment provider.
- Technical data: standard request data processed by our hosting providers (for example IP address and user agent) for security, abuse prevention, and reliability.
What we do not collect: no advertising identifiers, no third-party analytics or tracking pixels, no location or contacts access, and no advertising cookies.
3. How we use information
- To create and authenticate your account and keep you signed in.
- To save and display your family's progress.
- To activate and manage paid memberships and answer billing questions.
- To provide customer support and send essential account or service messages.
- To keep the service secure and to comply with legal obligations.
We do not use your data for advertising, profiling, or automated decision-making, and we do not sell or rent personal information.
4. Children's privacy
Xiaoya Growth Partner is designed to be used by an adult parent or guardian together with a child. Accounts must be created and owned by a person aged 18 or older. We do not knowingly collect personal information directly from children, we do not allow children to create accounts, and we do not operate public profiles, messaging, social feeds, or any feature that lets a child publish content.
A child's nickname and age are entered by the parent and stored inside the parent's account. We use this only to select age-appropriate content and to show progress to that parent. If you believe a child has provided personal information to us without parental consent, email us and we will delete it.
5. Payment information
Paid plans are sold through Creem, which acts as the Merchant of Record for the transaction. Checkout is completed on Creem's infrastructure. We do not receive or store your full card number, card security code, or bank details. We receive only what is needed to grant and manage your membership: email address, order or subscription identifier, plan, status, and billing period. Payment data you give to Creem is governed by Creem's own privacy policy.
6. Cookies and local storage
- Strictly necessary: an authentication token kept by our authentication provider so you stay signed in between visits.
- Local preferences: small values stored in your browser by the app.
We do not use advertising, cross-site tracking, or third-party marketing cookies. Clearing your browser storage signs you out.
7. Service providers
- Supabase — authentication, database, and serverless functions.
- Cloudflare — website hosting and delivery.
- Creem — payment processing, subscription management, and Merchant of Record.
These providers process data on our behalf. We do not share personal information with advertisers or data brokers.
8. Data retention
Account and progress data are kept while your account exists. Billing records are kept as long as required for tax and accounting obligations. When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except records we must keep by law.
9. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. Email nexoralabs392@gmail.com from the address registered on your account. We respond within 30 days.
California residents and residents of other US states with consumer privacy laws: we do not sell or share personal information as those terms are defined by those laws.
10. Security
All traffic is served over HTTPS. Database row-level security rules ensure an account can read and write only its own records. Administrative keys are stored server-side and are never exposed to the browser. No system is perfectly secure, so please use a unique password.
11. International transfers
Our service providers may process data in the United States, the European Union, and other regions. Where required, transfers rely on the providers' standard contractual clauses and equivalent safeguards.
12. Changes to this policy
If we make material changes we will update the effective date above and, where appropriate, notify you by email or in the app. Continued use of the service after an update means you accept the revised policy.
13. Contact
Questions, requests, or complaints: nexoralabs392@gmail.com.
隐私政策（中文）
产品：面向 5–10 岁家庭的网页应用，家长与孩子每天共读一个成长故事、进行一次对话，并完成一个现实中的小行动。
客服邮箱：nexoralabs392@gmail.com
一、概述
我们只收集运行账号、保存进度和提供付费会员所必需的最少信息。我们不售卖个人数据。本站不使用广告，也不做第三方追踪。
二、我们收集的信息
- 账号信息：邮箱地址和密码。密码由认证服务商以加盐哈希方式保存，我们无法看到也不会保存明文密码。
- 你填写的资料：可选的孩子昵称、年龄或年龄段，以及你选择的成长主题。
- 进度数据：打开过哪些故事、完成了哪些行动、成长能量、当前天数、最后更新时间。
- 会员数据：套餐名称、订阅状态、当前计费周期结束时间，由支付服务商发来的支付事件生成。
- 技术数据：托管服务商处理的标准请求数据（如 IP 地址、User Agent），用于安全、防滥用和稳定性。
我们不收集：广告标识符；不使用第三方分析或追踪像素；不请求位置或通讯录权限；不设置广告 Cookie。
三、信息用途
- 创建和验证账号、保持登录状态。
- 保存并展示家庭成长进度。
- 开通和管理付费会员，处理账单问题。
- 提供客服支持，发送必要的账号或服务通知。
- 保障服务安全并履行法律义务。
我们不会将你的数据用于广告、画像或自动化决策，也不会出售或出租个人信息。
四、儿童隐私
本产品设计为由成年家长或监护人陪同孩子使用。账号必须由 18 岁及以上的成年人创建并持有。我们不会有意直接向儿童收集个人信息，不允许儿童自行注册，也不提供公开主页、私信、社交动态等让儿童发布内容的功能。孩子的昵称与年龄由家长填写，仅保存在家长账号内，仅用于选择适龄内容和向该家长展示进度。如你认为儿童在未经家长同意的情况下向我们提供了个人信息，请邮件告知，我们会删除。
五、支付信息
付费套餐通过 Creem 销售，Creem 是交易的记录商户（Merchant of Record）。结账在 Creem 的页面完成。我们不接收也不保存你的完整卡号、安全码或银行信息，只接收开通和管理会员所需的信息：邮箱、订单或订阅编号、套餐、状态和计费周期。你提供给 Creem 的支付数据适用 Creem 自身的隐私政策。
六、Cookie 与本地存储
- 必要存储：认证服务商保存的登录凭证，用于保持登录状态。
- 本地偏好：应用在浏览器中保存的少量设置。
我们不使用广告、跨站追踪或第三方营销 Cookie。清除浏览器存储会退出登录。
七、服务提供商
- Supabase —— 身份认证、数据库、函数服务。
- Cloudflare —— 网站托管与分发。
- Creem —— 支付处理、订阅管理与记录商户。
这些供应商以受托方身份处理数据。我们不会向广告商或数据经纪人共享个人信息。
八、数据保留
账号与进度数据在账号存续期间保留。账单记录按税务与会计义务要求的期限保留。你要求删除账号后，我们会在 30 天内删除或匿名化个人信息，法律要求保留的记录除外。
九、你的权利
根据你所在地区法律，你可能有权访问、更正、导出或删除个人信息，有权反对或限制某些处理，并有权撤回同意。请用账号注册邮箱发送邮件至 nexoralabs392@gmail.com，我们将在 30 天内回复。美国加州及其他消费者隐私法适用州的居民：我们不按相关法律的定义出售或共享个人信息。
十、安全
全站通过 HTTPS 提供。数据访问受数据库行级安全策略限制，每个账号只能读写自己的记录。管理密钥仅保存在服务端，永远不会出现在浏览器中。任何系统都无法做到绝对安全，请使用独立密码。
十一、跨境传输
我们的服务商可能在美国、欧盟及其他地区处理数据。必要时，传输依据服务商的标准合同条款及等效保障措施进行。
十二、政策变更
如发生重大变更，我们会更新上方生效日期，并在适当情况下通过邮件或应用内通知你。变更后继续使用服务即表示接受修订后的政策。
十三、联系方式
问题、请求或投诉：nexoralabs392@gmail.com。